At least with plugins most people have a general notion that they run some sort of code as they provide some new functionality.

Much more agregiously you can design harmless a looking format that can run arbitrary code e.g. .doc with VBS. I have a very hard time blaming an user who falls for that even though MS puts up a scary looking popup.